Malicious code in bigops-telephony-ui-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95bba7270d3de4aa970aefb0ef6b0017f4d9663219dd0eccbb44b5d3c9dd6f6a The package main index.js unconditionally requires init.js, which on module load selects a platform-specific asset linuxx64, linuxarm64, darwin, win3...

Malicious code in bigops-tcrm-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1 The package's main index.js requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from...

Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in bnpl-blocks-atom-bnpl-action-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f63c6572613805a02fc6c829d61dbd9a3aaa9b300147c9fe2f1fc74821cef8 On require of the package, index.js loads loader.js which selects a platform-specific payload path, fetches bytes from one of three runtime-assembled...

Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78c9360e199f852a5b395b6549e12b6334ec3dce096462a4404a3a0e809f545 On require of this package, index.js loads runtime.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12878 Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...

Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12751 Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

Malicious code in @wololasod/tiny-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on...

Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

Malicious code in pfp-forms-sme-loan (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in streak-daily-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7 [email protected]'s main entry index.mjs runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to...

MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...